I'm learning android application pen testing and I'm kinda lost about what can do an attacker that control the content of a webview ?
I guess if there is no javascript enabled there is no impact, right ? But if there is JavaScript enabled but no JavaScript interface or other dangerous setup, what can do an attacker ?
I know he/she can make an alert box or write anything on the page but it doesn't provide impact.
Is there some other things an attacker can do with javascript enabled and nothing else ?
Thanks